Skip to content

Producción en VPS2: Docker + nginx + TLS + auto-deploy#1

Open
eddndev wants to merge 3 commits into
mainfrom
chore/prod-deploy-vps2
Open

Producción en VPS2: Docker + nginx + TLS + auto-deploy#1
eddndev wants to merge 3 commits into
mainfrom
chore/prod-deploy-vps2

Conversation

@eddndev

@eddndev eddndev commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Resumen

Monta DEMS API en producción en VPS2 (https://dems.eddndev.work) y automatiza el despliegue. La API ya está viva y verificada end-to-end (esta rama documenta/versiona la infra que se aplicó).

Cambios

Infra de despliegue (924659f)

  • apps/api/Dockerfile — build multi-stage (dems-api + seed), hermético (todo runtime sqlx, sin .sqlx). Migraciones corren al arrancar.
  • deploy/docker-compose.prod.ymlapi (127.0.0.1:8090) + postgres dedicado (volumen propio, no publicado).
  • deploy/nginx/dems.eddndev.work.conf — reverse proxy (certbot añade TLS).
  • deploy/.env.prod.example + deploy/README.md (runbook). deploy/.env git-ignored.

Mobile (4508db8)

  • Env.apiBaseUrl: builds de release → producción; debug/profile mantienen defaults locales; override --dart-define=API_BASE_URL sigue ganando.

CI/CD (7c421fe)

  • Job deploy (needs api+mobile, solo en push a main) corre en el runner self-hosted de VPS2: rsync a /opt/dems (preserva deploy/.env), docker compose up -d --build, health check contra /readyz.

Estado en producción (ya aplicado)

  • TLS Let's Encrypt + Cloudflare proxied. Contenedores restart: unless-stopped, sobreviven reboot.
  • Datos base sembrados; credencial admin por defecto ya rotada.

Notas

  • El job deploy solo dispara al hacer merge a main. En este PR corren api + mobile (tests), no deploy.
  • /opt/dems es propiedad de github-runner para permitir el deploy local del runner.

- apps/api/Dockerfile: multi-stage build (dems-api + seed), hermetic
  (runtime sqlx only, no .sqlx needed); migrations run on startup.
- deploy/docker-compose.prod.yml: api (127.0.0.1:8090) + dedicated postgres.
- deploy/nginx/dems.eddndev.work.conf: reverse proxy template (certbot adds TLS).
- deploy/.env.prod.example + deploy/README.md runbook.
- gitignore deploy/.env.
Env.apiBaseUrl: builds de release → https://dems.eddndev.work; debug/profile
mantienen los defaults locales (10.0.2.2 / localhost). El override por
--dart-define=API_BASE_URL sigue teniendo prioridad.
Job 'deploy' (needs api+mobile, solo push a main) corre en el runner
self-hosted de VPS2: rsync del checkout a /opt/dems (preservando deploy/.env),
docker compose up -d --build, y health check contra /readyz.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants